AWS Users at Risk: whoAMI Attack Enables Remote Code Execution

A new cybersecurity threat called the “whoAMI” attack is putting Amazon Web Services (AWS) users at risk by exploiting name confusion in Amazon Machine Images (AMI). This attack allows malicious actors to execute remote code on AWS accounts by tricking systems into using a compromised AMI instead of a legitimate one.

How the whoAMI Attack Works

The whoAMI attack, revealed by Datadog Security Labs researcher Seth Art, takes advantage of misconfigured software that searches for AMIs without specifying ownership details. When an AMI is created in AWS, it serves as a virtual machine image that launches Elastic Compute Cloud (EC2) instances. Attackers can upload their own malicious AMIs to the public AWS Community AMI catalog, giving them an opportunity to hijack unsuspecting users’ deployments.

According to Datadog’s report, this vulnerability exists due to the way some systems retrieve AMI IDs using the ec2:DescribeImages API. If the API call does not specify an owner, it may return results from any AMI that matches the given name filter. This opens the door for attackers to create malicious AMIs with names identical to trusted ones.

For the attack to succeed, three conditions must be met:

1. The AMI search is conducted using only the name filter.

2. The owner, owner-alias, or owner-id parameters are not specified.

3. The most recent matching image is automatically selected (most_recent=true).

If these conditions are met, an attacker can inject their own AMI, causing AWS to unknowingly deploy a compromised instance. Once executed, this grants remote code execution (RCE) privileges, allowing the attacker to manipulate the affected system.

whoAMI & Dependency Confusion Attack

The whoAMI attack is similar to dependency confusion attacks, which occur when software mistakenly installs a malicious package instead of a legitimate one. In this case, instead of a software dependency (such as a Python or npm package), the compromised resource is a virtual machine image. Attackers take advantage of the lack of ownership verification to insert their own AMIs into the selection process.

Real-World Impact of the whoAMI Attack

Datadog’s analysis found that around 1% of organizations they monitor were vulnerable to the whoAMI attack. Their research also uncovered public examples of affected code in multiple programming languages, including Python, Go, Java, Terraform, Pulumi, and Bash shell scripts.

While there is no evidence that this attack has been exploited in real-world cyberattacks, it presents a significant security risk. AWS investigated the issue and confirmed that only authorized security researchers had tested the technique. However, they advised customers to review their AMI retrieval processes to prevent potential exploitation.